Re: Text Relocations
> On Mon, Dec 13, 2004 at 03:35:14PM +0100, pageexec@... wrote:
> > in general hunting down and fixing textrelocs requires some detective
> > work and quite a bit of understanding of how the toolchain works. if you
> > want to do it yourself, let me know and i'll try to dig up what i wrote
> > to some gentoo hardened people a while ago. you should also enter this
> > and other cases into the gentoo bugzilla so that the devs are aware of
> > it.
since some people asked off-list, so i dug it up finally:
1. readelf -l app -> note down the read-only PT_LOAD segment info,
in particular VirtAddr and FileSiz, these provide the boundaries
for the next step.
2. readelf -r app -> look for addresses under the Offset column that
fall into the above determined range, not all types are interesting,
only R_386_RELATIVE, R_386_32 and R_386_PC32 (all those are specific
to i386 of course and i hope i didn't miss anything).
3. objdump -d app -> in the disassembly find the instructions around
the addresses obtained in the previous step, on i386 they will never
be the same exactly because a relocation falls into an instruction,
e.g., if there's a reloc item on 0804c74c then in the disassembly
you will find that the instruction that will be relocated is at
0804c74b or 0804c74a or something a few bytes lower. in any case,
what matters is the function name in which this relocation is, you
can just scroll up in the disasm and see which function appears first,
that's the guy that wasn't compiled properly or has some issues (e.g.,
it comes from a .S file). of course you must have debug info for this
to work, so have nostrip enabled.